Auditing Sustainability Assurance Statements: Where Financial Audit Standards Fit and Where They Fall Short

1. Introduction

A reader who opens the sustainability report of a large listed company will usually find, somewhere near the back, a short statement signed by an assurance provider. It looks like an audit report and borrows much of an audit report's vocabulary, but it is a different product. It typically covers a selection of indicators rather than the whole report, it is often expressed in the negative form of a limited assurance conclusion, and the firm that signed it may be an accounting practice, an engineering consultancy or a certification body. Surveys of reporting practice suggest that a majority of the world's largest companies now obtain assurance of this kind (KPMG, 2022).

For most of its history this was a voluntary market. Companies bought assurance because they judged that it would make their disclosures more believable (Simnett et al., 2009), and the choice of provider, scope and standard was largely theirs. That is changing. The European Union's Corporate Sustainability Reporting Directive requires assurance over sustainability statements (European Union, 2022), the International Sustainability Standards Board has issued its first two disclosure standards (ISSB, 2023), and the International Auditing and Assurance Standards Board has completed a dedicated assurance standard, ISSA 5000 (IAASB, 2024). Once assurance is compulsory, the question of what standard it is performed under stops being a matter of taste.

The profession's answer so far has been to extend the financial audit model. ISAE 3000 was written by auditors, uses the audit risk logic, and assumes a practitioner trained in it. ISSA 5000 keeps that foundation while opening the door to other professions. This review asks a narrow question about that choice: which parts of the financial audit apparatus hold up when the subject matter is sustainability information, and which parts strain or fail? The question matters because an assurance conclusion is only as good as the fit between the method and the thing examined, a point Power (1997) made long ago about audit in general.

2. Scope and Approach

This is a narrative review, not a systematic one. It draws on two bodies of material. The first is the text of the standards themselves: ISAE 3000 (Revised), ISAE 3410 on greenhouse gas statements, the IAASB's guidance on extended external reporting, AA1000AS v3 and ISSA 5000. The second is the peer-reviewed literature on sustainability assurance, entered through the three published literature reviews that map the field (Cohen and Simnett, 2015; Farooq and de Villiers, 2017; Velte and Stawinoga, 2017) and followed outward to the studies they rely on most heavily. No new data were collected and no meta-analysis was attempted. Where the literature disagrees, both sides are reported.

3. The Standards in Use

Three standards account for nearly all assurance statements issued on sustainability reports, and they come from two quite different traditions. ISAE 3000 is the IAASB's umbrella standard for assurance engagements other than audits or reviews of historical financial information. It was first issued in 2003 and substantially revised in 2013 (IAASB, 2013). It says nothing about sustainability as such; it sets out how any assurance engagement should be accepted, planned, performed and reported, and it offers two levels of conclusion, reasonable and limited. ISAE 3410, issued in 2012, adds subject-specific requirements for greenhouse gas statements.

AA1000AS comes from AccountAbility, a body with roots in stakeholder engagement and no connection to the audit profession. Its current version dates from 2020 (AccountAbility, 2020). Where ISAE 3000 asks whether reported information is free from material misstatement, AA1000AS asks first whether the organisation adheres to a set of principles (inclusivity, materiality, responsiveness and impact) and only then, in what it calls a Type 2 engagement, whether specified performance information is reliable. Early comparisons of the two found that they produced visibly different statements and were frequently used together (Manetti and Becatti, 2009).

ISSA 5000 is the newest of the three. It was approved in 2024 as a stand-alone standard for sustainability assurance, designed to work with any reporting framework and to be usable by practitioners who are not professional accountants, provided they meet equivalent ethical and quality management requirements (IAASB, 2024). Table 1 sets the three side by side, and Figure 1 places them on a timeline with the reporting requirements that prompted them.

4. Where Financial Audit Standards Fit

It would be easy to treat the financial audit as simply the wrong tool. The literature does not support that reading. In at least three respects the audit model brings something that sustainability assurance needs and that alternative traditions have struggled to supply.

4.1. Engagement architecture and quality management

An audit is a structured process: acceptance and continuance procedures, an understanding of the entity and its controls, an assessment of where misstatement is likely, a response to those risks, and a report in a prescribed form. ISAE 3000 imports that structure wholesale, together with firm-level quality management and engagement-level review. The value of this is easiest to see in its absence. Content analyses of assurance statements have repeatedly found statements that do not name the criteria used, do not describe the work performed, or do not make clear what was and was not covered (O'Dwyer and Owen, 2005; Gürtürk and Hahn, 2016). A standard that fixes the elements of the report and requires the practitioner to consider whether the criteria are suitable before accepting the engagement addresses exactly those weaknesses.

4.2. Evidence, documentation and scepticism

Auditors are trained to ask what would have to be true for a number to be right and then to go and look. That habit, with the documentation that supports it, transfers directly to quantitative sustainability indicators such as energy use, emissions, injury rates or workforce composition. The studies that test report quality rather than perception point the same way. Moroney et al. (2012) found that assured environmental disclosures were of higher quality than unassured ones, and Ballou et al. (2018) found that accounting-firm assurers were associated with the detection and correction of errors in previously reported sustainability figures. Comparative work on providers suggests that accounting firms tend to apply more procedural, evidence-led approaches, while consultancies lean towards evaluative, advisory ones (Channuntapipat et al., 2020).

4.3. Independence and ethics

The third strength is the ethical framework. Financial auditors work under codified independence rules, external inspection and personal liability. Critics of early sustainability assurance described the opposite: engagements whose scope was set by management, addressed to management, and performed by firms that also advised the client on its reporting, a pattern O'Dwyer and Owen (2005) called managerial capture. Independence rules do not remove commercial pressure, and interview evidence shows that assurance providers still feel it keenly (Boiral et al., 2019). They do, however, give the practitioner a basis for refusing, and users appear to notice: analysts in an experimental setting rated assured information as more credible, and in some jurisdictions rated it higher still when the assurer was a professional accountant (Pflugrath et al., 2011).

5. Where They Fall Short

The difficulties begin where sustainability information stops resembling financial information. Four of them recur across the literature.

5.1. Materiality beyond the investor

Audit materiality is defined by reference to the economic decisions of users of the financial statements, in practice investors and lenders, and it is operationalised as a monetary threshold. Sustainability reports are written for a wider audience, and under the European rules they must reflect a company's impacts on people and the environment as well as the financial effects of sustainability matters on the company. There is no single unit in which a tonne of emissions, a fatality and a breach of a supplier code can be added up, and no percentage-of-profit rule that tells the practitioner when an omission matters to a community living near a plant. AA1000AS handles this by making stakeholder materiality a principle to be assured in its own right. The ISAE tradition handles it by deferring to the reporting criteria, which moves the difficulty rather than resolving it. The IAASB's own guidance on extended external reporting concedes that assessing the entity's materiality process is among the hardest parts of these engagements (IAASB, 2021).

5.2. Narrative, forward-looking and value-chain information

Financial statements are the output of a double-entry system with controls built around it. Much of a sustainability report is not. Policies, governance descriptions, transition plans and targets are narrative; scenario analysis and net-zero commitments are forward-looking; and a large share of the quantitative content, notably emissions arising upstream and downstream of the company, comes from suppliers and customers the reporting entity neither controls nor audits. Audit standards have something to say about estimates and about the use of experts, but they were not designed for claims whose accuracy cannot be known for decades or for data assembled from industry averages. Krasodomska et al. (2021) identify immature reporting systems, qualitative information and future-oriented information as the recurring practical obstacles, and Michelon et al. (2015) found that assurance, along with other reporting practices, was not associated with better disclosure quality, which they read as evidence of a largely symbolic use.

5.3. Limited assurance and the expectation gap

Most sustainability assurance is limited assurance. The practitioner does less work, mainly enquiry and analytical procedures, and reports that nothing has come to their attention to suggest the information is materially misstated. The standards explain the distinction carefully. Readers, on the whole, do not absorb it. Hodge et al. (2009) showed that the presence of assurance raised users' confidence, and that the level of assurance mattered only in combination with the type of provider. A conclusion that is designed to convey modest comfort is therefore at risk of conveying a good deal more. The financial audit has lived with an expectation gap for decades; limited assurance on sustainability information widens it, because the wording is unfamiliar and the amount of work behind it varies from one engagement to the next.

5.4. Competence and the boundary of the profession

The last difficulty is about who does the work. Verifying methane measurements, biodiversity baselines or human rights due diligence calls for knowledge that an audit qualification does not provide. Accounting firms respond by building multidisciplinary teams, and the standards permit reliance on experts, but the engagement leader still has to be able to judge the expert's work. O'Dwyer et al. (2011) documented how accounting firms worked to make this new form of assurance legitimate, both inside their own organisations and with clients and report users. Whether the market should belong to one profession remains open: evidence that accountants are seen as more credible sits beside evidence that the choice of provider follows national institutional settings as much as competence (Kolk and Perego, 2010). ISSA 5000's profession-agnostic design is an attempt to settle the matter by regulating the engagement and not the practitioner's background.

6. What the Evidence Says

The empirical work supports a cautious conclusion and not much more. On perception, the findings are fairly consistent: assured reports are judged more credible by analysts and other users (Hodge et al., 2009; Pflugrath et al., 2011), and in the United States assurance has been linked to lower cost of capital and smaller analyst forecast errors (Casey and Grenier, 2015). On substance, the picture is less tidy. Some studies find better disclosures and more corrections where assurance is present, others find no detectable difference, and qualitative work with practitioners describes engagements shaped by fee pressure and by clients' wish for reassurance over challenge (Boiral et al., 2019).

Two cautions apply when reading this record. Nearly all of it comes from the voluntary era, when companies chose whether to be assured and by whom, so the samples are self-selected and the results may not carry over to a mandatory regime. And much of it measures the presence of an assurance statement, not the quality of the work behind it, which outsiders cannot observe. The broader review of mandatory sustainability reporting by Christensen et al. (2021) reaches a similar view: the effects of disclosure rules depend heavily on enforcement, and assurance is one of the few enforcement mechanisms available.

7. Implications

For practitioners, the review suggests treating the audit model as a floor. Its process discipline is worth keeping, but an engagement team needs to plan explicitly for the areas the model does not reach: how the client decided what was material and for whom, how narrative claims will be tested against something other than management's own description, and how much reliance can honestly be placed on value-chain estimates. Where those questions cannot be answered, the scope paragraph should say so in plain words.

For standard setters, the open issues are the ones ISSA 5000 inherits and does not close. Guidance on assuring a double materiality assessment is thin. The work effort that separates limited from reasonable assurance is described in general terms, which leaves room for conclusions that read alike to rest on very different amounts of evidence. Reporting on forward-looking information needs wording that users will not mistake for a forecast endorsement.

For researchers, the move from voluntary to mandatory assurance is a natural experiment that will not come round again. Studies that compare the same companies before and after the requirement, that look inside engagements instead of at the published statement, and that test whether readers understand what a limited assurance conclusion means would each fill a gap the existing literature has pointed to for some time (Cohen and Simnett, 2015).

8. Conclusion

Financial audit standards give sustainability assurance a structure, a method for testing numbers and an ethical frame, and the evidence suggests that these matter. They do not supply a workable concept of materiality for audiences other than investors, a way of testing narrative and future-oriented claims, or a form of conclusion that readers interpret correctly. ISSA 5000 narrows some of these gaps and leaves others where they were. The practical consequence is that an assurance statement on a sustainability report should be read for what it covers and how much work stands behind it, and that those who write the standards and perform the engagements carry the burden of making both things clear.

Conflict of interest

To be declared by the author(s) before publication.

Funding

To be declared by the author(s) before publication.